Palo Alto Networks: Fully Valued (NASDAQ:PANW)

Palo Alto Networks’ (NASDAQ:PANW) Q1 FY2024 results were somewhat soft, with NGS growth beginning to moderate and hardware sales normalizing. The company remains well positioned though, due to its large customer base and broad portfolio of solutions. In particular, XSIAM and SASE should drive growth going forward. The stock is starting to look fully valued though, meaning investors should not rely on further multiple expansion to drive returns.

Market

There are a number of cybersecurity trends that should prove favorable to Palo Alto over time. The SEC now requires companies to disclose breaches within four days, increasing the need for tools that enable companies to rapidly identify and remediate issues. This should help drive demand for security operations tools like Palo Alto’s XSIAM.

Adversarial cybersecurity activity also continues to increase, both in terms of the volume and scale of attacks. In particular, ransomware attacks are increasing in frequency and severity. This should see cybersecurity spending continue to increase as a percentage of IT budgets.

Consolidation is also an emerging trend that is likely to prove beneficial to Palo Alto. Some of this is being driven by customers, with 75% of companies pursuing a vendor consolidation strategy. There are thousands of cybersecurity companies and the largest only has 1.5% market share. This indicates that cybersecurity is structurally different from many other software categories, although this could be set to change. The growing importance of data and cloud infrastructure provides economies of scale, and synergies between tools are making an integrated portfolio of solutions the preferred approach.

While the long-term outlook is favorable, Palo Alto’s business continues to face near-term headwinds due to the macro environment. Scrutiny remains elevated and sales cycles are longer than usual. Businesses are adjusting to the higher interest rate environment though, with a number of cybersecurity vendors suggesting that market conditions were stabilizing.

Palo Alto recently stated that the pricing environment has stabilized, coming after pricing pressure in the previous fiscal year. Pricing pressure has been attributed to competitors trying to dislodge Palo Alto. This presumably refers to Palo Alto’s next-gen security offerings, which is interesting given that CrowdStrike’s (CRWD) pricing has been fairly stable. This could then be a reference to SASE, where Cloudflare (NET) likely has a significantly lower-priced product.

Data

The rising complexity and sophistication of attacks means that data is now central to cybersecurity. Palo Alto believes that for most companies, 45% of security data comes from the firewall and another 40% comes from the endpoint. Palo Alto’s large customer base (~62,000 firewall customers) and solid position within the firewall market therefore gives it a strong competitive position from a data perspective. Palo Alto analyzes around 76 terabytes of data per day and believes that it is the largest user of BigQuery in the world. This access to data is behind Palo Alto’s XSIAM solution and is difficult for most companies to replicate.

As a counterpoint, CrowdStrike has stated that around 85% of the valuable data comes from the endpoint as data gets filtered as it is transferred across the network, causing a loss of fidelity.

Palo Alto Networks

Palo Alto recently suggested that it is focused on integrating its solutions. This could suggest that the company is now approaching a full suite of solutions and that the pace of acquisitions may decline going forward. Palo Alto is still pursuing acquisition for the time being though, recently acquiring Dig Security and Talon Cyber Security for 232 million USD and 435 million USD respectively.

Companies like CrowdStrike have been touting their unified solutions, which is clearly a shot at Palo Alto’s strategy. There are pros and cons to internal development though. For example, it could be argued that Fortinet’s focus on internal development has left it on the back foot in SASE.

With costs front of mind for customers, along with the interest rates, Palo Alto has implemented a number of strategies to help attract and retain customers. The company recently made the Unit 42 Rapid Incident Response Retainer available at no cost to all of its strategic customers. Other actions include annual billing plans, financing through PANFS, and partner financing.

SOC

Palo Alto believes that current security operations center approaches are outdated and that the market is about to undergo a paradigm shift. SOCs monitor, detect, and respond to threats but this is becoming difficult due to the volume and complexity of attacks. SIEM is used post-breach or post-event to figure out what happened, but enforcement and remediation capabilities are needed. Automating the security operations center is also important, as there is a labor shortage within cybersecurity. SOC presents a 30 billion USD opportunity, which Palo Alto believes could grow to 80-90 billion USD over the next decade, driven by AI.

Palo Alto’s XSIAM product was launched close to 12 months ago and did around 200 million USD of bookings in the first 9 months. XSIAM combines an endpoint agent with a data lake and AI, allowing mean response times to decline dramatically.

Palo Alto’s Cortex customer count increased by 25% YoY in Q1 FY2024 to over 5,300 customers. While this is impressive, Palo Alto appears to view Cortex largely as a customer acquisition tool for XSIAM. The company’s XSIAM pipeline is now over 1 billion USD, of which 500 million USD was created in the last quarter alone.

SASE

Palo Alto estimates that SASE will be a 20-30 billion USD market, and so far only around 15% of the market has adopted this architecture. Palo Alto continues to suggest that there are only two and a half players in the market. Presumably referring to Palo Alto, Zscaler, and one of Fortinet, Cato, or Cloudflare.

Palo Alto recently acquired Talon Cyber Security to support its SASE business. Talon provides remote browser isolation technology. The combination of Talon and Prisma SASE will enable users to securely access business applications from any device. Palo Alto has suggested that this is not currently addressed by any SASE vendor but both Cloudflare and Zscaler have browser isolation solutions.

SASE is an important growth driver for Palo Alto at the moment, with its SASE ARR increasing approximately 60% YoY in Q1.

Cloud Security

Palo Alto’s cloud security business will be bolstered by the planned acquisition of Dig Security, which will provide Data Security posture management capabilities. Around 70% of organizations have data stored in the public cloud, and the security of that data is threatened by generative AI and a proliferation of cloud services. Palo Alto plans on integrating Dig’s capabilities into its Prisma Cloud platform.

Hardware

There continues to be an industry-wide normalization on the hardware side of Palo Alto’s business. As supply chain pressures have eased, backlogs have been reduced, and for some companies, this is now impacting sales. Palo Alto has stated that it never had a large backlog, which may be contributing to the relative strength of its product business. Going forward Palo Alto expects mid- to low-single digit industry product growth.

Financial Analysis

Palo Alto’s revenue increased 20% YoY in Q1 FY2024 driven by growth in next-gen security solutions. NGS ARR grew 53% YoY and is now in excess of 3 billion USD. Product revenue grew 3% and total service revenue grew 25%, with subscription revenue growing 29% and support revenue growing 17%. Growth was fairly consistent across regions, with Palo Alto’s Americas business growing 20%, EMEA up 19%, and JPAC increasing 23%.

Second quarter revenue is expected to be 1.955-1.985 billion USD, an increase of 18%-20% YoY. For the full fiscal year, revenue is expected to increase 18-19%, with NGS ARR expected to grow 34-35% YoY. The expected decline in NGS growth should be concerning for Palo Alto investors, as it is this part of the business that has been Palo Alto’s growth engine over the past few years.

Palo Alto continues to win new customers, particularly larger organizations, and is driving adoption of its platform within that customer base. As of Q1, 56% of the Global 2000 has transacted with Palo Alto. 34% of Palo Alto’s customer base has deployed all three form factors. Within Palo Alto’s top 100 network security customers, 60% have purchased all three form factors, and on average these customers spend over 15 times more than Palo Alto’s other network security customers.

Palo Alto’s product gross profit margins are trending higher because of growth in the contribution from high-margin software revenue. The easing of supply chain pressures also likely contributed to the rebound in product gross profit margins. The growth of Palo Alto’s XSIAM and SASE solutions should also be supportive of gross profit margins. Given Palo Alto’s reliance on the hyperscalers for infrastructure, SASE margins may not be that high though.

Depending on how competition evolves and the scale that is reached, cybersecurity leaders like Palo Alto appear to be heading towards operating profit margins well in excess of 30%. With Palo Alto demonstrating strong operating leverage over the past 2 years, this is now being reflected in the stock price.

Conclusion

The market is currently placing a premium on profitability, and this situation is likely to persist while interest rates are elevated and economic uncertainty is high. This is favorable for Palo Alto, as it is one of the few cybersecurity companies offering both solid growth at scale and profitability.

The company is now facing headwinds on the hardware side of its business, although, given its current revenue mix, this is not a significant concern. Growth is being driven by cross-selling next-gen security solutions to its existing customer base and leveraging its large sales force to rapidly grow the revenue of acquired businesses.

There is a risk of growth deceleration as Palo Alto begins to saturate its existing customer base though. Given the value of solutions like SASE and XSIAM per customer, and relatively low adoption rates, this may not occur for some time yet. Palo Alto’s stock likely continues to do ok going forward, provided the macro environment remains stable, but there may not be much more room for multiple expansion.